CVSS 10.0 RCE vulnerability disclosed in PHP core, patches only for PHP 8
cyb3rops · x · 2026-10-21
Security researcher cyb3rops confirmed a CVSS 10.0 remote code execution vulnerability in PHP core, with full details scheduled for release on October 20. Only PHP 8 will receive patches — older branches are expected to remain unpatched. Teams should inventory affected systems ahead of disclosure.
More from Safety
- Policy experts urge BIS and DDTC to assess frontier models' ability to aid export-controlled tech — jachiam0 · 2026-10-21
- Fake-stats site deindexed by Google was still cited by ChatGPT for 7 months — petrusenko_max · 2026-10-21
- Princeton launches AI Alignment and Safety research initiative — HazanPrinceton · 2026-10-21
- ByteDance, Alibaba, Tencent order 3M+ Nvidia RTX PRO 5500 cards worth $35B, Reuters reports — SumitGup · 2026-10-21
- Antigen launches Assets: a security agent that maps your infrastructure and triages new CVEs — alishbaimran_ · 2026-10-21
- GitHub HQ Hosts Open Source AI + Policy Talk with Mozilla Co-founder Mitchell Baker — kevinsxu · 2026-10-21